1. Field of the Invention
Overall, the invention relates to synchronized electronic integrated circuits equipped with means for combinational logic, with flip-flops, and with means for testing.
More precisely, the invention relates to an electronic circuit comprising: a number of logic cells; a number of configurable cells each comprising at least a multiplexer and a flip-flop; and a number of control conductors connected, for some of them at least, to the configurable cells and on which control signals, selectively circulate, received and/or emitted during the operating of a control circuit such as an access control, the configurable cells selectively adopting, depending on the control signals, a standard operating mode in which they are operationally connected to at least some of the logic cells with which they co-operate to create a logic circuit, and a test mode in which these configurable cells are operationally connected in chains to create a shift register equipped with a data input and output.
2. Discussion of the Related Art
Nowadays it is common knowledge that the proper working order of the operating elements of an integrated circuit should be checked by imposing and/or by determining, at pre-set times, the data at certain internal points of this integrated circuit.
Such a test technique of the internal paths of an integrated circuit (designated “scanpath” or “internal scan method”) is for example disclosed in the document by M. Williams and J. Angel, entitled “Enhancing Testability of LSI Circuits Via Test Points and Additional Logic, IEEE Transactions on Computers”, vol. C-22, No.1. January 1973, which is incorporated herein by reference.
According to this technique, each of the flip-flops in the logic circuit, for which it is useful to know the state and/or to impose the content during the standard operating of the integrated circuit, is equipped with a multiplexer at its input.
The different flip-flops and the multiplexers which are connected to them thus constitute the equivalent number of configurable cells whose access is controlled by these multiplexers.
The multiplexers of these different configurable cells are jointly controlled by an access controller or “TAP controller” (Test Access Port) which, according to a chosen operating mode, uses this set of configurable cells either as a standard operating circuit integrated into the logic circuit which it creates with the logic cells, or as a test circuit.
To accomplish this, the TAP controller receives control signals on different control conductors, and/or consigns control signals on different control conductors by which it is connected to the different configurable cells, such as a mode control signals, a chain control signal or a data propagation control signal, which permit the modifying and/or modify the data circulation paths within the integrated circuit and thus allow entry of this data, for future analysis, via the controller.
In the standard operating mode, the TAP controller therefore pilots the multiplexers of the configurable cells in such a way that the flip-flops of these cells are connected to the surrounding logic cells in order to define one or several operating sub-sets of the integrated circuit.
In the test mode, which is generally triggered off when the TAP controller receives an impulse control signal in test mode, this controller generates a chaining control signal in order to connect, in series, the flip-flops of the configurable cells so as to create a shift register.
This register includes a series input and a serial output respectively connected to an output and an input of the TAP controller, as well as a clock input receiving a clock signal in order to give rhythm to the flow of data.
Initially, the TAP controller loads, in series, the data in the flip-flops of the configurable cells via the shift register input that creates these cells.
Then, the TAP controller changes the switching of the multiplexers in order to create the operational circuit, and controls the running of one or several clock cycles via this operational circuit. In this stage, the data loaded into the flip-flops of the configurable cells is handled by the operational circuit.
The controller then, once again, changes the switching of the multiplexers in order to, once again, create the shift register and restores, in series on the output of this shift register, the data stored in the flip-flops of the configurable cells during the last clock cycle.
Despite the proven interest of this testing technique, its practical application can under certain circumstances prove to be problematic, notably on integrated circuits which handle secret data.
Indeed, as the actuating of the test mode can allow a fraudulent operator to read the content of the flip-flops of the configurable cells, this test technique has, in principle, the inconvenience of rendering such circuits very vulnerable to fraudulent activity.
For example, by stopping, at different moments, an internal secret data loading process in the integrated circuit and by off-loading the contents of the shift register, a fraudulent operator can obtain information from the secret data, even reconstitute it.
By actuating the test mode, a fraudulent operator can also gain write access to the flip-flops of the configurable cells so as to insert fraudulent data, or to put the integrated circuit into an unauthorized configuration. The person can thus, for example, gain access to a register that controls a security element such as a sensor in order to deactivate it. The person can also input erroneous data with the aim of obtaining information on secret data.
The fraud can have two different strategies; the first consists in taking control of the TAP controller and observing on the external contacts the contents of the shift register cells, and the second consists in taking control of the configurable cells by exciting them via microprobing in order to simulate the piloting of these cells by the control signals that the TAP controller emits.
Attempt fraud as per the first strategy can be stopped via a technique which is covered by an application being filed at this same time by the holder.
One purpose of the invention is to propose an electronic circuit designed to foul attempts at fraud in compliance with aforementioned second strategy.